181
INL ulog-php prior 0.8.2 port.php SQL Injection
CGI
2004/09/08
Marc Ruef
marc dot ruef at computec dot ch
http://www.computec.ch
computec.ch
Marc Ruef
marc dot ruef at computec dot ch
http://www.computec.ch
computec.ch
2004/11/14
2.0
Corrected the plugin structure and added the accuracy values in 1.1. Improved the pattern matching and introduced the plugin changelog in 2.0
tcp
80
open|send GET /port.php?proto=tcp' HTTP/1.0\n\n|sleep|close|pattern_exists HTTP/#.# ### *select ip_saddr,ip_daddr,ip_protocol,oob_time_sec,tcp_sport,tcp_dport,udp_sport,udp_dport,oob_prefix,id*
95
This plugin was written with the ATK Attack Editor and inspired by the Nessus plugin.
info at inl dot fr
http://www.inl.fr
INL
2004/08/23
http://www.inl.fr/rubrique.php3?id_rubrique=11
INL ulog-php prior 0.8.2
INL ulog-php newer than 0.8.2 or other solutions
SQL Injection
The remote host is running ulog-php, a firewall log analysis interfacewritten in PHP. There is a bug in port.php which may allow an attacker to force it to execute arbitrary SQL statements on the remote host. An attacker may use this flaw to gain the control of the remote website and possibly execute arbitrary commands on the remote host.
Disable this suite or upgrade to the latest version and limit unwanted connections and communications with firewalling. Change the default directory of the application to make automated scans harder.
Approx. 30 minutes
Yes
http://www.securityfocus.com/bid/11018/exploit/
Yes
Yes
High
6
7
8
7
High
Nessus is able to do the same check.
11018
14363
Hacking Exposed: Network Security Secrets & Solutions, Stuart McClure, Joel Scambray and George Kurtz, February 25, 2003, 4th Edition, McGraw-Hill Osborne Media, ISBN 0072227427
http://www.computec.ch
